binder: avoid using strong references on nodes for internal refs
The binder driver bumps the local_strong_refs while it is using the associated node. This needs to change to local_weak_refs to avoid inadvertantly causing the node to be destroyed in userspace. Bug: 36093037 Change-Id: Id085851407b6ea2a99affddd27ae4d9908149847 Test: tested manually Signed-off-by: Todd Kjos <tkjos@google.com>
This commit is contained in:
@@ -684,7 +684,7 @@ static struct binder_node *binder_get_node(struct binder_proc *proc,
|
||||
else if (ptr > node->ptr)
|
||||
n = n->rb_right;
|
||||
else {
|
||||
node->local_strong_refs++;
|
||||
node->local_weak_refs++;
|
||||
binder_proc_unlock(proc, __LINE__);
|
||||
return node;
|
||||
}
|
||||
@@ -728,7 +728,7 @@ static struct binder_node *binder_new_node(struct binder_proc *proc,
|
||||
else if (ptr > node->ptr)
|
||||
p = &(*p)->rb_right;
|
||||
else {
|
||||
node->local_strong_refs++;
|
||||
node->local_weak_refs++;
|
||||
binder_proc_unlock(proc, __LINE__);
|
||||
kfree(temp_node);
|
||||
return node;
|
||||
@@ -758,7 +758,7 @@ static struct binder_node *binder_new_node(struct binder_proc *proc,
|
||||
|
||||
rb_link_node(&node->rb_node, parent, p);
|
||||
rb_insert_color(&node->rb_node, &proc->nodes);
|
||||
node->local_strong_refs++;
|
||||
node->local_weak_refs++;
|
||||
binder_proc_unlock(proc, __LINE__);
|
||||
|
||||
return node;
|
||||
@@ -870,7 +870,7 @@ done:
|
||||
|
||||
static inline void binder_put_node(struct binder_node *node)
|
||||
{
|
||||
binder_dec_node(node, 1, 0);
|
||||
binder_dec_node(node, 0, 0);
|
||||
}
|
||||
|
||||
static struct binder_ref *binder_get_ref(struct binder_proc *proc,
|
||||
|
||||
Reference in New Issue
Block a user